{"api_version":"1","generated_at":"2026-08-02T07:28:24+00:00","cve":"CVE-2025-71126","urls":{"html":"https://cve.report/CVE-2025-71126","api":"https://cve.report/api/cve/CVE-2025-71126.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-71126","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-71126"},"summary":{"title":"mptcp: avoid deadlock on fallback while reinjecting","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: avoid deadlock on fallback while reinjecting\n\nJakub reported an MPTCP deadlock at fallback time:\n\n WARNING: possible recursive locking detected\n 6.18.0-rc7-virtme #1 Not tainted\n --------------------------------------------\n mptcp_connect/20858 is trying to acquire lock:\n ff1100001da18b60 (&msk->fallback_lock){+.-.}-{3:3}, at: __mptcp_try_fallback+0xd8/0x280\n\n but task is already holding lock:\n ff1100001da18b60 (&msk->fallback_lock){+.-.}-{3:3}, at: __mptcp_retrans+0x352/0xaa0\n\n other info that might help us debug this:\n  Possible unsafe locking scenario:\n\n        CPU0\n        ----\n   lock(&msk->fallback_lock);\n   lock(&msk->fallback_lock);\n\n  *** DEADLOCK ***\n\n  May be due to missing lock nesting notation\n\n 3 locks held by mptcp_connect/20858:\n  #0: ff1100001da18290 (sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_sendmsg+0x114/0x1bc0\n  #1: ff1100001db40fd0 (k-sk_lock-AF_INET#2){+.+.}-{0:0}, at: __mptcp_retrans+0x2cb/0xaa0\n  #2: ff1100001da18b60 (&msk->fallback_lock){+.-.}-{3:3}, at: __mptcp_retrans+0x352/0xaa0\n\n stack backtrace:\n CPU: 0 UID: 0 PID: 20858 Comm: mptcp_connect Not tainted 6.18.0-rc7-virtme #1 PREEMPT(full)\n Hardware name: Bochs, BIOS Bochs 01/01/2011\n Call Trace:\n  <TASK>\n  dump_stack_lvl+0x6f/0xa0\n  print_deadlock_bug.cold+0xc0/0xcd\n  validate_chain+0x2ff/0x5f0\n  __lock_acquire+0x34c/0x740\n  lock_acquire.part.0+0xbc/0x260\n  _raw_spin_lock_bh+0x38/0x50\n  __mptcp_try_fallback+0xd8/0x280\n  mptcp_sendmsg_frag+0x16c2/0x3050\n  __mptcp_retrans+0x421/0xaa0\n  mptcp_release_cb+0x5aa/0xa70\n  release_sock+0xab/0x1d0\n  mptcp_sendmsg+0xd5b/0x1bc0\n  sock_write_iter+0x281/0x4d0\n  new_sync_write+0x3c5/0x6f0\n  vfs_write+0x65e/0xbb0\n  ksys_write+0x17e/0x200\n  do_syscall_64+0xbb/0xfd0\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x7fa5627cbc5e\n Code: 4d 89 d8 e8 14 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa\n RSP: 002b:00007fff1fe14700 EFLAGS: 00000202 ORIG_RAX: 0000000000000001\n RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fa5627cbc5e\n RDX: 0000000000001f9c RSI: 00007fff1fe16984 RDI: 0000000000000005\n RBP: 00007fff1fe14710 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000202 R12: 00007fff1fe16920\n R13: 0000000000002000 R14: 0000000000001f9c R15: 0000000000001f9c\n\nThe packet scheduler could attempt a reinjection after receiving an\nMP_FAIL and before the infinite map has been transmitted, causing a\ndeadlock since MPTCP needs to do the reinjection atomically from WRT\nfallback.\n\nAddress the issue explicitly avoiding the reinjection in the critical\nscenario. Note that this is the only fallback critical section that\ncould potentially send packets and hit the double-lock.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-01-14 15:16:02","updated_at":"2026-07-30 06:24:52"},"problem_types":["CWE-667"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/252892d5a6a2f163ce18f32716e46fa4da7d4e79","name":"https://git.kernel.org/stable/c/252892d5a6a2f163ce18f32716e46fa4da7d4e79","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ffb8c27b0539dd90262d1021488e7817fae57c42","name":"https://git.kernel.org/stable/c/ffb8c27b0539dd90262d1021488e7817fae57c42","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/0ca9fb4335e726dab4f23b3bfe87271d8f005f41","name":"https://git.kernel.org/stable/c/0ca9fb4335e726dab4f23b3bfe87271d8f005f41","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/50f47c02be419bf0a3ae94c118addf67beef359f","name":"https://git.kernel.org/stable/c/50f47c02be419bf0a3ae94c118addf67beef359f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/0107442e82c0f8d6010e07e6030741c59c520d6e","name":"https://git.kernel.org/stable/c/0107442e82c0f8d6010e07e6030741c59c520d6e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-71126","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71126","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5586518bec27666c747cd52aabb62d485686d0bf 0107442e82c0f8d6010e07e6030741c59c520d6e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 75a4c9ab8a7af0d76b31ccd1188ed178c38b35d2 252892d5a6a2f163ce18f32716e46fa4da7d4e79 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 54999dea879fecb761225e28f274b40662918c30 0ca9fb4335e726dab4f23b3bfe87271d8f005f41 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f8a1d9b18c5efc76784f5a326e905f641f839894 50f47c02be419bf0a3ae94c118addf67beef359f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f8a1d9b18c5efc76784f5a326e905f641f839894 ffb8c27b0539dd90262d1021488e7817fae57c42 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1d82a8fe6ee4afdc92f4e8808c9dad2a6095bbc5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.1.149 6.1.160 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.6.101 6.6.120 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.12.40 6.12.64 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.15.8 6.16 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.16","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.16 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.160 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.120 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.64 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.3 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.19 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2025","cve_id":"71126","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/mptcp/protocol.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0107442e82c0f8d6010e07e6030741c59c520d6e","status":"affected","version":"5586518bec27666c747cd52aabb62d485686d0bf","versionType":"git"},{"lessThan":"252892d5a6a2f163ce18f32716e46fa4da7d4e79","status":"affected","version":"75a4c9ab8a7af0d76b31ccd1188ed178c38b35d2","versionType":"git"},{"lessThan":"0ca9fb4335e726dab4f23b3bfe87271d8f005f41","status":"affected","version":"54999dea879fecb761225e28f274b40662918c30","versionType":"git"},{"lessThan":"50f47c02be419bf0a3ae94c118addf67beef359f","status":"affected","version":"f8a1d9b18c5efc76784f5a326e905f641f839894","versionType":"git"},{"lessThan":"ffb8c27b0539dd90262d1021488e7817fae57c42","status":"affected","version":"f8a1d9b18c5efc76784f5a326e905f641f839894","versionType":"git"},{"status":"affected","version":"1d82a8fe6ee4afdc92f4e8808c9dad2a6095bbc5","versionType":"git"},{"lessThan":"6.1.160","status":"affected","version":"6.1.149","versionType":"semver"},{"lessThan":"6.6.120","status":"affected","version":"6.6.101","versionType":"semver"},{"lessThan":"6.12.64","status":"affected","version":"6.12.40","versionType":"semver"},{"lessThan":"6.16","status":"affected","version":"6.15.8","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/mptcp/protocol.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.160","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.120","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.64","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.19","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.160","versionStartIncluding":"6.1.149","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.120","versionStartIncluding":"6.6.101","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.64","versionStartIncluding":"6.12.40","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.3","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.19","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: avoid deadlock on fallback while reinjecting\n\nJakub reported an MPTCP deadlock at fallback time:\n\n WARNING: possible recursive locking detected\n 6.18.0-rc7-virtme #1 Not tainted\n --------------------------------------------\n mptcp_connect/20858 is trying to acquire lock:\n ff1100001da18b60 (&msk->fallback_lock){+.-.}-{3:3}, at: __mptcp_try_fallback+0xd8/0x280\n\n but task is already holding lock:\n ff1100001da18b60 (&msk->fallback_lock){+.-.}-{3:3}, at: __mptcp_retrans+0x352/0xaa0\n\n other info that might help us debug this:\n  Possible unsafe locking scenario:\n\n        CPU0\n        ----\n   lock(&msk->fallback_lock);\n   lock(&msk->fallback_lock);\n\n  *** DEADLOCK ***\n\n  May be due to missing lock nesting notation\n\n 3 locks held by mptcp_connect/20858:\n  #0: ff1100001da18290 (sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_sendmsg+0x114/0x1bc0\n  #1: ff1100001db40fd0 (k-sk_lock-AF_INET#2){+.+.}-{0:0}, at: __mptcp_retrans+0x2cb/0xaa0\n  #2: ff1100001da18b60 (&msk->fallback_lock){+.-.}-{3:3}, at: __mptcp_retrans+0x352/0xaa0\n\n stack backtrace:\n CPU: 0 UID: 0 PID: 20858 Comm: mptcp_connect Not tainted 6.18.0-rc7-virtme #1 PREEMPT(full)\n Hardware name: Bochs, BIOS Bochs 01/01/2011\n Call Trace:\n  <TASK>\n  dump_stack_lvl+0x6f/0xa0\n  print_deadlock_bug.cold+0xc0/0xcd\n  validate_chain+0x2ff/0x5f0\n  __lock_acquire+0x34c/0x740\n  lock_acquire.part.0+0xbc/0x260\n  _raw_spin_lock_bh+0x38/0x50\n  __mptcp_try_fallback+0xd8/0x280\n  mptcp_sendmsg_frag+0x16c2/0x3050\n  __mptcp_retrans+0x421/0xaa0\n  mptcp_release_cb+0x5aa/0xa70\n  release_sock+0xab/0x1d0\n  mptcp_sendmsg+0xd5b/0x1bc0\n  sock_write_iter+0x281/0x4d0\n  new_sync_write+0x3c5/0x6f0\n  vfs_write+0x65e/0xbb0\n  ksys_write+0x17e/0x200\n  do_syscall_64+0xbb/0xfd0\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x7fa5627cbc5e\n Code: 4d 89 d8 e8 14 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa\n RSP: 002b:00007fff1fe14700 EFLAGS: 00000202 ORIG_RAX: 0000000000000001\n RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fa5627cbc5e\n RDX: 0000000000001f9c RSI: 00007fff1fe16984 RDI: 0000000000000005\n RBP: 00007fff1fe14710 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000202 R12: 00007fff1fe16920\n R13: 0000000000002000 R14: 0000000000001f9c R15: 0000000000001f9c\n\nThe packet scheduler could attempt a reinjection after receiving an\nMP_FAIL and before the infinite map has been transmitted, causing a\ndeadlock since MPTCP needs to do the reinjection atomically from WRT\nfallback.\n\nAddress the issue explicitly avoiding the reinjection in the critical\nscenario. Note that this is the only fallback critical section that\ncould potentially send packets and hit the double-lock."}],"metrics":[{"cvssV3_1":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"providerMetadata":{"dateUpdated":"2026-07-30T06:05:22.014Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/0107442e82c0f8d6010e07e6030741c59c520d6e"},{"url":"https://git.kernel.org/stable/c/252892d5a6a2f163ce18f32716e46fa4da7d4e79"},{"url":"https://git.kernel.org/stable/c/0ca9fb4335e726dab4f23b3bfe87271d8f005f41"},{"url":"https://git.kernel.org/stable/c/50f47c02be419bf0a3ae94c118addf67beef359f"},{"url":"https://git.kernel.org/stable/c/ffb8c27b0539dd90262d1021488e7817fae57c42"}],"title":"mptcp: avoid deadlock on fallback while reinjecting","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2025-71126","datePublished":"2026-01-14T15:06:11.417Z","dateReserved":"2026-01-13T15:30:19.655Z","dateUpdated":"2026-07-30T06:05:22.014Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-01-14 15:16:02","lastModifiedDate":"2026-07-30 06:24:52","problem_types":["CWE-667"],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.149","versionEndExcluding":"6.1.160","matchCriteriaId":"A82FD07D-EDB4-49EC-8123-407B5046415D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.101","versionEndExcluding":"6.6.120","matchCriteriaId":"03D395F6-2EB4-4D8F-8750-7294B02A75E7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.40","versionEndExcluding":"6.12.64","matchCriteriaId":"3A463EA9-8294-45DB-A398-3B7860CDF976"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15.8","versionEndExcluding":"6.16","matchCriteriaId":"EA66C243-6DF2-4727-A595-DD89F076A762"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16.1","versionEndExcluding":"6.18.3","matchCriteriaId":"8F519034-DE85-479C-A073-22A202B0A1BE"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*","matchCriteriaId":"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*","matchCriteriaId":"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*","matchCriteriaId":"F71D92C0-C023-48BD-B3B6-70B638EEE298"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*","matchCriteriaId":"13580667-0A98-40CC-B29F-D12790B91BDB"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*","matchCriteriaId":"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*","matchCriteriaId":"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*","matchCriteriaId":"F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*","matchCriteriaId":"EB5B7DFC-C36B-45D8-922C-877569FDDF43"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"71126","Ordinal":"1","Title":"mptcp: avoid deadlock on fallback while reinjecting","CVE":"CVE-2025-71126","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"71126","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: avoid deadlock on fallback while reinjecting\n\nJakub reported an MPTCP deadlock at fallback time:\n\n WARNING: possible recursive locking detected\n 6.18.0-rc7-virtme #1 Not tainted\n --------------------------------------------\n mptcp_connect/20858 is trying to acquire lock:\n ff1100001da18b60 (&msk->fallback_lock){+.-.}-{3:3}, at: __mptcp_try_fallback+0xd8/0x280\n\n but task is already holding lock:\n ff1100001da18b60 (&msk->fallback_lock){+.-.}-{3:3}, at: __mptcp_retrans+0x352/0xaa0\n\n other info that might help us debug this:\n  Possible unsafe locking scenario:\n\n        CPU0\n        ----\n   lock(&msk->fallback_lock);\n   lock(&msk->fallback_lock);\n\n  *** DEADLOCK ***\n\n  May be due to missing lock nesting notation\n\n 3 locks held by mptcp_connect/20858:\n  #0: ff1100001da18290 (sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_sendmsg+0x114/0x1bc0\n  #1: ff1100001db40fd0 (k-sk_lock-AF_INET#2){+.+.}-{0:0}, at: __mptcp_retrans+0x2cb/0xaa0\n  #2: ff1100001da18b60 (&msk->fallback_lock){+.-.}-{3:3}, at: __mptcp_retrans+0x352/0xaa0\n\n stack backtrace:\n CPU: 0 UID: 0 PID: 20858 Comm: mptcp_connect Not tainted 6.18.0-rc7-virtme #1 PREEMPT(full)\n Hardware name: Bochs, BIOS Bochs 01/01/2011\n Call Trace:\n  <TASK>\n  dump_stack_lvl+0x6f/0xa0\n  print_deadlock_bug.cold+0xc0/0xcd\n  validate_chain+0x2ff/0x5f0\n  __lock_acquire+0x34c/0x740\n  lock_acquire.part.0+0xbc/0x260\n  _raw_spin_lock_bh+0x38/0x50\n  __mptcp_try_fallback+0xd8/0x280\n  mptcp_sendmsg_frag+0x16c2/0x3050\n  __mptcp_retrans+0x421/0xaa0\n  mptcp_release_cb+0x5aa/0xa70\n  release_sock+0xab/0x1d0\n  mptcp_sendmsg+0xd5b/0x1bc0\n  sock_write_iter+0x281/0x4d0\n  new_sync_write+0x3c5/0x6f0\n  vfs_write+0x65e/0xbb0\n  ksys_write+0x17e/0x200\n  do_syscall_64+0xbb/0xfd0\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x7fa5627cbc5e\n Code: 4d 89 d8 e8 14 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa\n RSP: 002b:00007fff1fe14700 EFLAGS: 00000202 ORIG_RAX: 0000000000000001\n RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fa5627cbc5e\n RDX: 0000000000001f9c RSI: 00007fff1fe16984 RDI: 0000000000000005\n RBP: 00007fff1fe14710 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000202 R12: 00007fff1fe16920\n R13: 0000000000002000 R14: 0000000000001f9c R15: 0000000000001f9c\n\nThe packet scheduler could attempt a reinjection after receiving an\nMP_FAIL and before the infinite map has been transmitted, causing a\ndeadlock since MPTCP needs to do the reinjection atomically from WRT\nfallback.\n\nAddress the issue explicitly avoiding the reinjection in the critical\nscenario. Note that this is the only fallback critical section that\ncould potentially send packets and hit the double-lock.","Type":"Description","Title":"mptcp: avoid deadlock on fallback while reinjecting"}]}}}